SC-200 Practice Test 41 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Sentinel. You notice that MDI alerts are not appearing in Sentinel. You have already installed the MDI data connector and configured the workspace. What is the most likely cause?

Accepted Answer

The data connector is not enabled, even though it is installed. Option A is correct because the connector needs to be enabled. Option B is wrong because it still works. Option C is wrong because it's not required. Option D is wrong because the connector handles ingestion.

Answer

The workspace is in a different region than MDI

Answer

The Microsoft 365 Defender connector is not installed

Answer

Microsoft Defender for Identity is not licensed

Question 2

You are configuring Microsoft Sentinel to use Microsoft Copilot for Security. Which TWO prerequisites must be met?

Accepted Answer

Ensure that the Microsoft Defender XDR tenant is integrated with Copilot for Security.. Options A and B are correct. Copilot for Security requires the Security Compute Units and the Microsoft Defender XDR integrated tenant. Option C is incorrect because Copilot for Security does not require a premium license. Option D is incorrect because Copilot for Security is a separate service, not a workspace feature. Option E is incorrect because Copilot for Security is available in multiple regions.

Answer

Enable Copilot for Security in the Microsoft Sentinel workspace settings.

Answer

Deploy Copilot for Security in the same Azure region as the Sentinel workspace.

Answer

Purchase a Microsoft Sentinel premium license.

Question 3

Your organization uses Microsoft Sentinel with a workspace in the East US region. You have a playbook that escalates incidents to ServiceNow. Due to compliance requirements, all data must remain in the West Europe region. You need to ensure that the playbook execution and any data it processes stays within West Europe. What should you do?

Accepted Answer

Create the playbook as a Logic App in the West Europe region and ensure it uses a managed identity for authentication.. Playbooks run in the same region as the Logic Apps resource, which can be created in West Europe. By creating the playbook in West Europe, it will process data there. Option D is correct. Option A is wrong because moving the Sentinel workspace is not possible without redeployment. Option B is wrong because the API connector does not control data location. Option C is wrong because using a different workspace would require changing all data collection.

Answer

Use a different Sentinel workspace in West Europe for the incidents.

Answer

Move the Sentinel workspace to West Europe.

Answer

Configure the ServiceNow connector to use a West Europe endpoint.

Question 4

Your organization uses Microsoft Sentinel and wants to ensure that all incident-related data is retained for at least 90 days for compliance purposes. Which configuration should you check?

Accepted Answer

Log Analytics workspace retention settings. Option B is correct because data retention in Microsoft Sentinel is set at the Log Analytics workspace level. Option A is wrong because analytics rules generate incidents but don't control retention. Option C is wrong because watchlists are for data correlation, not retention. Option D is wrong because the incidents blade shows incidents but does not configure retention.

Answer

Watchlist settings

Answer

Analytics rule settings

Answer

Incident settings in Sentinel

Question 5

Which THREE of the following are valid components of Microsoft Defender XDR? (Select three.)

Accepted Answer

Microsoft Defender for Endpoint. Options A, B, and C are correct. Microsoft Defender for Identity, Defender for Office 365, and Defender for Endpoint are core components of Microsoft Defender XDR. Option D is wrong because Microsoft Sentinel is a separate SIEM product, not part of Defender XDR. Option E is wrong because Microsoft Purview is a compliance product.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 6

Your Microsoft Defender XDR environment is experiencing high false positive rates for a specific type of alert. You need to reduce the noise without completely disabling the alert. What is the most effective method?

Accepted Answer

Create a custom detection rule to tune the detection logic.. Custom detections in Microsoft Defender XDR allow you to create custom rules that tune the detection logic, e.g., by adding conditions to reduce false positives. Option A is wrong because suppression rules hide alerts but do not address the root cause. Option C is wrong because disabling the alert removes detection entirely. Option D is wrong because automation rules can only handle incidents after generation, not prevent false alerts.

Answer

Create a suppression rule for the alert.

Answer

Use an automation rule to automatically close the false positive incidents.

Answer

Disable the built-in detection rule.

Question 7

Your organization has Microsoft Defender for Office 365 enabled. Users report that phishing emails are being delivered to their inboxes. You need to improve the filtering. What should you do first?

Accepted Answer

Review phishing emails in Threat Explorer and adjust anti-phishing policies.. Reviewing the Threat Explorer in Defender for Office 365 allows you to analyze detected phishing emails and understand why they were delivered, then adjust policies accordingly. Option A is wrong because increasing spam confidence level might block legitimate email. Option C is wrong because disabling third-party connectors doesn't help. Option D is wrong because enabling secure by default is already enabled.

Answer

Increase the spam confidence level threshold.

Answer

Disable third-party email connectors.

Answer

Enable the 'Secure by default' setting in Exchange Online.

Question 8

Your organization has a Microsoft Sentinel workspace that ingests logs from multiple sources. You need to implement a process to review and approve changes to analytics rules before they are deployed to production. What should you use?

Accepted Answer

Configure Microsoft Sentinel repository integration with Azure DevOps and use branch policies for approval.. Option A is correct because Microsoft Sentinel's repository integration with Azure DevOps or GitHub supports CI/CD with pull requests for approval. Option B is wrong because playbooks are for automation, not rule management. Option C is wrong because workbooks are for visualization. Option D is wrong because notebooks are for advanced analytics.

Answer

Create a playbook that emails the SOC manager when an analytics rule is modified.

Answer

Use a workbook to track changes to analytics rules.

Answer

Export analytics rules to a notebook for manual review.

Question 9

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What is the effect of this rule?

Accepted Answer

It changes the status of newly created incidents from 'New' to 'Active'.. Option B is correct because the rule triggers on incident creation with status 'New' and changes status to 'Active'. Option A is incorrect because it does not assign owner. Option C is incorrect because it does not suppress. Option D is incorrect because it does not create tasks.

Answer

It assigns the incident to the SOC team.

Answer

It suppresses the incident if it is a false positive.

Answer

It creates a task in the incident for investigation.

Question 10

Refer to the exhibit. You run this PowerShell script. What is the effect on the SecurityEvent table in the SOC-Workspace Log Analytics workspace?

Accepted Answer

The table will retain data interactively for 365 days, and data will be archived for an additional 365 days, total 730 days.. Option A is correct because the script sets the interactive retention to 365 days and the total retention (including archive) to 730 days. Option B is incorrect because it does not set to 90 and 365. Option C is incorrect because basic logs are not configured. Option D is incorrect because it does not set both to 730.

Answer

The table will retain data interactively for 90 days and archived for 275 days.

Answer

The table will be converted to Basic Logs.

Answer

The table will retain data for 730 days interactively.

Question 11

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). Which of the following connectors should you use to collect sign-in logs and audit logs?

Accepted Answer

Microsoft Entra ID connector.. The Microsoft Entra ID connector provides sign-in logs and audit logs directly to Sentinel. Option A is correct. Option B is wrong because Office 365 connector is for Exchange, SharePoint, etc. Option C is wrong because Azure Activity connector is for Azure resource logs. Option D is wrong because Microsoft Defender for Cloud is for security alerts.

Answer

Microsoft Defender for Cloud connector.

Answer

Office 365 connector.

Answer

Azure Activity connector.

Question 12

Your organization has Microsoft Defender for Cloud Apps and Microsoft Sentinel integrated. The security team wants to receive alerts when a user's activity from an anonymous IP address exceeds a certain risk score. What should you configure in Defender for Cloud Apps?

Accepted Answer

Activity policy. Option C is correct because activity policies in Defender for Cloud Apps allow you to monitor and alert on specific user activities, such as those from anonymous IP addresses, and can trigger alerts based on risk score thresholds. Option A is wrong because anomaly detection policies detect unusual behavior patterns, not specific activity from anonymous IPs. Option B is wrong because app discovery policies are for discovering cloud apps, not user activities. Option D is wrong because file policies are for monitoring file access and sharing.

Answer

Anomaly detection policy

Answer

File policy

Answer

App discovery policy

Question 13

You are reviewing the automation rule configuration shown in the exhibit. What is the purpose of this rule?

Accepted Answer

Run a playbook to isolate a device when an incident with 'Malware' in the alert title is created. Option B is correct because the rule triggers on incidents with alert title containing 'Malware' and runs a playbook named 'IsolateDevice'. Option A is wrong because the condition is on alert title, not severity. Option C is wrong because the condition is on incident creation, not resolution. Option D is wrong because the trigger type is 'Incident', not 'Alert'.

Answer

Automatically resolve incidents related to malware

Answer

Automatically close incidents with 'Malware' in the title

Answer

Create a playbook for malware alerts

Question 14

Your organization uses Microsoft Sentinel and has enabled UEBA. You notice that many low-severity incidents are being created from high-volume informational alerts. You want to reduce noise without disabling data connectors. What should you do?

Accepted Answer

Modify the analytics rule query to exclude the high-volume informational events using KQL.. Option C is correct because analytics rule tuning using KQL allows you to filter out specific events or conditions, reducing false positives. Option A is wrong because disabling connectors would stop all data ingestion, not just noise. Option B is wrong because suppression is typically used for incidents, not at the rule level for noise reduction. Option D is wrong because automation rules act after incident creation, not prevent it.

Answer

Create an automation rule that closes low-severity incidents immediately.

Answer

Increase the incident creation threshold in the analytics rule.

Answer

Disable the Microsoft 365 Defender connector for those data sources.

Question 15

Which THREE are valid incident classification options in Microsoft Sentinel?

Accepted Answer

Benign Positive. Option A is correct because 'True Positive' is a standard classification. Option C is correct because 'False Positive' is standard. Option D is correct because 'Benign Positive' is a classification for non-malicious but relevant activity. Option B is wrong because 'Malicious' is a sub-classification, not a main classification. Option E is wrong because 'Informational' is not a classification; it's a severity level.

Answer

Informational

Answer

Malicious